WARNING

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Thu Mar 03, 2016 8:13 pm

WARNING

Attachments in emails and not to open.

How many times have we all seen the warning about don’t open attachments sent in emails on this site and did we take any real notice of it.

This is what happened to me when I clicked on an attachment sent to me in an email, without thinking.
First there was no action, other than a whirling sound from the hard drive, followed by the screen going black.
Then a small box opened, with, I think the words “Do you want this programme” YES” or “NO”, so click on NO, nothing happens.
So the only option is to click on Yes, you then get 3 black pictures with white lettering, blackmailing you into calling a phone number in recovering your computer, screen mentions bitcoins.
This is a ENCRYPT virus, because I clicked on an attachment I had let it bypass my anti-virus (AVAST) and infected my computer.

Had to contact my friend Chris who had fixed my old computers in the past. He already knew what the problem was.
I now had 2 choices, first was to delete everything on the computer’s hard drive, nothing could be saved, second choice was to delete the virus in each of the files, one by one, this would take over a week to do, depending on how big the hard drive was. The cost in the UK money would be at least £1200 pounds.
I choose the first choice took 2 hours, reinstalled windows 10 and the files from my external backup drive, which was not up to date, £70 pounds and two cups of tea it cost me.

When I checked in my catcher account, I found this email, below,
Dear -
Scanned Invoice in Microsoft Word format has been attached to this email. Thank you!
Doreen Carroll Sales Manager

Now this was in a usual type, stands out a mile, notice that it’s a women’s name used, so was the one I got caught by.

HAVE FOUND A FEW MORE I HAVE BEEN SENT,

Dear Valued Customer,
It is very unpleasant to hear about the delay with your order #DED64532, but be sure that our department will do its best to resolve the problem. It usually takes around 7 business days to deliver a package of this size to your region.
The local post office should contact your as soon as they will receive the parcel. Be sure that your purchase will be delivered in time and we also guarantee that you will be satisfied with our services.
Thank you for your business with our company.
Walton Sykes
Sales Manager
Dear costumer,
You are receiving this informational letter because of the fact that you have a debt totalling $235,62 due to late payment of invoices dating March �15.
In attachment you will find a reconciliation of the past 12 months (year 2015).
Please study the file and contact us immediately to learn what steps you should take to avoid the accrual of penalties.
Dear Client,
According to the reconciliation of the Department of Finance there are the arrears following your client account totaling in $361,89 .
We attach the last unpaid invoice #25561041 to this letter and kindly ask you pay it off until March 31, 2016.
Please check out the file and do not hesitate to pay off the debt. We look forward to your reasonableness.
Dear Customer,

Your invoice appears below. Please remit payment at your earliest convenience.

Thank you for your business - we appreciate it very much.

Sincerely,

Noe Dotson Courier Service

All these had been sent as a message with an attachment, that is why they are here.

This is the headers from the first email I have shown, I have deleted my baiter name from the mail, first.

Return-Path: [email protected]
Received: from mip.hushmail.com (LHLO smtpl.hushmail.com) (65.39.178.7 Cool

b:
server with LMTP; Thu, 25 Feb 2016 18:19:58 +0000 (UTC)
Received: from smtpl.hushmail.com (localhost [127.0.0.1])
by smtpl.hushmail.com (Postfix) with SMTP id EE9EB401F3
for < [email protected]›; Thu, 25 Feb 2016 18:19:57 +000(
X-Hush-Verified-Domain: mykris.net
X-Hush-Real-Recipient: @hushmail.com
Received: from static-27-131-59-146.mykris.net (unknown [27.131.59.146]) by smtpl.hushmail.com (Postfix) with ESMTP
for < @hushmail.com>; Thu, 25 Feb 2016 18:19:53 +0000 (UT(
Message-ID: <[email protected]>
From: =?UTF-8?B?RG9yZWVuIENhcnJvbGw=?= <[email protected]>
To: =?UTF-8?B?YXV0bzI2MzQwMg==?= <, @hushmail.com>
Subject: [Suspected Junk Mail] =?UTF-8?B?U2Nhbm51ZCBJbnZvaWN1?= Date: Fri, 26 Feb 2016 02:19:50 +0800
Reply-To: =?UTF-8?B?YXV0bzI2MzQwMg==?= < @hushmail.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NexPart_002"

DON’T FORGET, BACK UP YOUR HARD DRIVE, REGULARLY

Posted: Thu Mar 03, 2016 8:47 pm

^ The wonderful Cryptolocker. I have seen that one to. I knew a guy that paid the ransom through bit coin. It still encrypted his files. Sadly the only thing to do is reformat the hard drive.

Posted: Thu Mar 03, 2016 8:56 pm

Ah yes, another great example that all those fancy warnings are there for a reason. We get used to seeing them on daily basis thanks to lurking the spam folders daily, but it can be a costly experience.

It is best to use Live CD Linux distribution for baiting, opening attachments and the like. I use it for browsing fake sites, attachments etc. It's an entire operating system, in usage similar to Windows (Ubuntu), I can open anything I want. The moment I unplug the drive (CD or USB) all the files are gone.

Baiting Guru Joined: 10 Oct 2010 Posts: 3876

Yes...

I already received 5 emails of that kind on my main real life mailaccount.

but using gmails web-frontend is quite safe, and gmail has put all 5 of them into spam.

otherwise, the result would've been quite nasty.

Posted: Thu Mar 03, 2016 11:16 pm

Under NO circumstances run a Windows machine with an IP address visible to the Internet. As my network has IPv6 addresses, that means no Windows machines at all are allowed here.

I have a Linux laptop and a DragonFly BSD box. Usually I use Linux for baiting. I had to switch to BSD when the laptop went down. I have an rsync script that keeps the scambait directory up to date, but had not run it in about two weeks when the laptop went down.

Posted: Fri Mar 04, 2016 7:23 am

I'm really sorry to hear it Fo'andles. Weird that AVAST didn't catch it.

I will look into Mortal's advice. It sounds great and I'm sure it doesn't use much system resources as VM with Windows does. I used to have one for this purpose, however it's been ages since I used it last time.

Posted: Fri Mar 04, 2016 7:51 am

Also virtualization has to be supported, while even a calculator can run Linux on its own Laughing

I ran xubuntu (a lightweight Ubuntu) on my Asus eee (remember when netbooks were a thing? Very Happy

)

Also having an ipad also helps a lot. Good luck targeting that with Windows malicious software! Smile

Posted: Fri Mar 04, 2016 6:31 pm

How much did they demand, Fo? Here is an example of a victim who had no choice to pay up big.

Posted: Fri Mar 04, 2016 6:49 pm

Worth a look..

http://www.bbc.com/news/technology-28661463

Posted: Fri Mar 04, 2016 9:46 pm

Lakeside77, wrote "How much did they demand".

Only saw black screen and bitcoin, that was enough for me, had my mate over to sort out computer, still have a few tweaks to sort out.

Posted: Sat Mar 05, 2016 8:56 pm

A sad story. I can empathise, as I lost a lot of files to Blaster in 2004.

For anyone who wants to maintain back-up (ie, duplicate) copies of their important files (eg, pics, docs, videos, etc) and is unsure what to do, this is a simple solution, even for those who are not particularly IT-minded. It is an external hard drive, which is simply a small box that you plug into the mains electricity and connect to your PC/laptop. It may be programmed to back-up (ie, copy) your files periodically.

I have one and it backs-up my images, audio, email, and docs, onto its hard drive once every 24 hours. If my PC is infected or goes permanently unserviceable, I have at least duplicate copies of my important files on my external hard drive, which I may later download onto another PC/laptop.

It is also useful for storing huge files or a huge amount of smaller files, which avoids cluttering up your PC/laptop.

http://www.seagate.com/gb/en/products/desktop-storage/desktop-external-drives/

Posted: Sat Mar 05, 2016 10:42 pm

Fo'andles I am so very sorry to hear about your experience. Just this morning, my new 2T backup drive arrived. I was going to get around to backing up my computer "sometime", but this post has lit a fire under me, and I will back up my machine today. Thank you. And again, I am so very sorry to hear the news. That sucks beyond belief.

Posted: Sat Mar 05, 2016 10:44 pm

Another good way of minimizing the risk is Sandboxie. It basically isolates a part of your computer from the rest of your system, so if any malware is executed within that isolated part, it doesn't affect the main OS.

Posted: Mon Mar 07, 2016 9:46 am

Quote:

For anyone who wants to maintain back-up (ie, duplicate) copies of their important files (eg, pics, docs, videos, etc) and is unsure what to do, this is a simple solution, even for those who are not particularly IT-minded. It is an external hard drive, which is simply a small box that you plug into the mains electricity and connect to your PC/laptop. It may be programmed to back-up (ie, copy) your files periodically.

Just a word of advice - make sure the file you're going to backup isn't damaged/ruined/modified/etc... otherwise it will ruin your backed up copy. It has happened to those making automatic backups without versioning. Once they noticed their file was damaged, it was too late as the damaged file was copied over the one in the backup making it useless.

Posted: Mon Mar 07, 2016 10:08 am

If you think you're safe from randsomware because you use a Mac, you're not.

http://www.cnbc.com/2016/03/07/apple-mac-users-targeted-by-first-full-ransomware-attack.html

Posted: Mon Mar 07, 2016 10:21 am

^^^^^
I've heard this bit of misinformation a lot."I won't get malware or viruses because I use Apple products, including iphones and ipads". Wrong. Check those apps you're always downloading.

Posted: Fri Mar 11, 2016 10:04 am

Sorry to hear that Fo. Linux Mint keeps me pretty safe from this kind of attack, though it's not 100% risky free.

very long link

There are some youtubes of people playing with ransomeware scammers. They get the vic to download some software that lets them take over the PC in real time and only make things worse by deleting files and such in front of them until they pay up.

I'm my own worst enemy when it comes to losing important data. Lazyness+Incompetence+Haste.

Posted: Sat Mar 12, 2016 10:12 pm

This is a follow up.

Because I did not pay their ransom, it seems I have annoyed the ransom scammers, so much so they are sending me further emails with attachments.

Below is a list of email addresses, they are using, the last two, belong to the 2 addresses shown.

@pspdemocenter.com
@uselessopinions.com
@impaul.com
@airtelbroadband.in
@pharmiq.com
@wei-guan.com.tw
@parkcafebar.ru
@telkom.net.id
@woolthuis.nl
@kramerelectronics.co.uk
@pier7marketing.com
@janisfamily.com

@iburst.co.za
@janegoodchild.com

<Name, address, and phone number redacted>

<Name, address, and phone number redacted> - bware419ers

Don't think this is the only email addresses they are using, also different names and sometimes with numbers.

So I'm now going see how many of the emails I get, the highest was last Wednesday 10 , hid my scammers email, only had a couple today.
Very Happy

Posted: Sat Mar 12, 2016 10:56 pm

I have redacted the name, address, and phone numbers above. First, you've been around long enough to know we don't post this without providing proof. There are no headers, whois, info, or anything else to haphazardly start posting that. None of that info even makes sense. The addresses were blocks apart and included two completely different zip codes. In fact, neither zip code belongs to any city in Florida, or the entire U.S.

You're dealing with hackers. They can spoof and steal email addresses, take over sites, etc. You should take none of the stuff you are receiving at face-value. If they are catcher accounts, I might just shut them down and start again.

Posted: Sun Mar 13, 2016 11:16 am

bware419ers,

I had already run this post in front of rover, he thought it was a good idea and also added if I get any crap from anyone to say he said it was ok.

If you had read the first post I made you would have seen examples of the emails they are using, they are now including addresses and telephone numbers, so I just included a couple of examples.

In conjunction with both posts I have made, the average intelligent person can have a fuller picture of what emails to avoid and how to deal with them.

Posted: Sun Mar 13, 2016 12:38 pm

The post itself might be a good idea, but posting the addresses and phone numbers isn't. Even if they belong to the owner of the domains then that doesn't mean they are the scammers/spammers/virus writers. They are more likely victims who have been hacked/phished or just had their email address spoofed. And we don't post victim details.

Posted: Thu Apr 07, 2016 6:27 pm

Received from "smtpl.hushmail.com"

This mail provider is known on the warez scene. They offer encrypted email services with PGP key and so on. This hacker was prepared.

Regarding "Sandboxie" (the option that gave TheDane) is not bulletproof.Since sandboxie is designed for split the system, the ransomware should be built to be able to break this.

So I.T. 101: do not open ANY attachement. If you want to do it just use common sense. Use a computer that you can format w/o problems or use a live cd from a linux distro. Wink

Hello I'm New here! Joined: 08 Apr 2016 Posts: 4

Yikes. That sucks, really sorry that happened to you and your computer.

Sorry for a newbie question, but this rises something I've been wondering about. I know not to download anything, but is it safe to view with the built in email image viewer the JPG images the lads occasionally send you? Or should you put in place precautions first?

Posted: Fri Apr 08, 2016 3:51 pm

^^^If you are talking about viewing them in the preview that Gmail and some of the other mail providers have then that is safe.

Hello I'm New here! Joined: 08 Apr 2016 Posts: 4

Yeah. Thanks for the answer. I'm glad to hear that.